Meet LabubaRAT: A Trojan With a Familiar Face

Cybersecurity researchers have uncovered a previously undocumented remote access trojan that borrows a trusted name to get a foot in the door. Dubbed LabubaRAT, this Rust-based malware masquerades as NVIDIA software to blend into Windows environments and avoid raising eyebrows.

Blackpoint Cyber analysts Sam Decker and Nevan Beal published their findings today, describing the tool as something that “creates a reusable foothold for hands-on activity.” Once it lands on a machine, it’s built to profile the host and open a backdoor for attackers to poke around at will.

This isn’t just another piece of commodity malware. It’s a crafted tool with a specific purpose: persistence, stealth, and remote control. And it’s wearing a disguise that could fool even a careful user.

Why the NVIDIA Disguise Is So Slick

The trick is simple but effective. The malware’s files, icons, and even its internal strings are designed to look like legitimate NVIDIA components. Think driver updater utilities, GPU monitoring tools, or installer packages. To the average eye — and to many automated scanners — it looks like the real deal.

Impersonating a well-known vendor like NVIDIA gives the attackers several advantages:

• Trust factor: Users are far less likely to question a pop-up or process that appears to come from a brand they recognize.
• Bypassing filters: Some security tools whitelist signed or known-good software names, which this trojan exploits.
• Muddying the waters: Even if someone spots suspicious activity, the NVIDIA branding makes it harder to report or investigate.

It’s a classic social engineering move, but with a technical twist. The malware doesn’t just claim to be NVIDIA — it’s built to look the part at the binary level.

Inside the Rust-Based RAT’s Arsenal

LabubaRAT is written in Rust, a language that’s become a favorite among malware authors for its performance and memory safety. But the real story is what the trojan does once it’s running.

According to the analysis, the RAT can profile the host system, gathering details about the operating system, hardware, and installed software. That reconnaissance helps attackers tailor their next moves. From there, it establishes a command-and-control channel, giving the operator a persistent way to issue commands.

Blackpoint’s researchers describe it as a “reusable foothold.” That’s a key distinction. Many trojans are one-shot tools — they execute a payload and disappear. LabubaRAT is designed to stick around, letting attackers return to the compromised machine whenever they need to.

What Hands-On Activity Looks Like

Once the backdoor is open, the attacker can do a lot with it. Common follow-ups include:

• Dumping credentials from memory or stored browsers
• Moving laterally across the network to reach other systems
• Deploying additional payloads like ransomware or keyloggers
• Exfiltrating sensitive files before anyone notices

The initial infection vector isn’t fully detailed in the report, but the NVIDIA disguise suggests a few possibilities. Malicious downloads, fake update prompts, or even poisoned search ads could all be in play.

How to Spot LabubaRAT Before It Bites

Detection isn’t impossible, but it requires a shift in mindset. Signature-based antivirus tools will likely miss this one if they haven’t updated their definitions yet. Instead, defenders need to look for behavioral clues.

Watch for processes that claim to be NVIDIA software but behave oddly — unusual network connections, high CPU usage, or attempts to write files to suspicious directories. Pay attention to unsigned binaries that use NVIDIA branding. Legitimate NVIDIA software is digitally signed; if a file fails signature verification, that’s a red flag.

Blackpoint’s researchers recommend monitoring for the specific indicators of compromise (IOCs) they’ve published, which include hashes and network endpoints. For most organizations, though, the simpler advice is to treat any unexpected “NVIDIA” process with suspicion and verify it against an official source.

If you’re looking to harden your defenses, it’s worth reviewing your endpoint security best practices and making sure your team knows how to recognize social engineering attempts. A little skepticism goes a long way.

The Bigger Picture: Brand Impersonation Is on the Rise

LabubaRAT isn’t an isolated incident. Attackers have been increasingly borrowing trusted brand names to slip past defenses. From fake Zoom installers to counterfeit Slack updates, the pattern is consistent: impersonate something familiar, and users will let their guard down.

For security teams, this means staying current on the latest malware trends and threat intelligence. It also means training users to question anything that seems even slightly off, no matter how legitimate it looks.

As for LabubaRAT, the discovery is a reminder that the threat landscape keeps evolving. The tools get craftier, the disguises get better, and the only defense is vigilance.

If you suspect a system is compromised, isolate it immediately and bring in your incident response team. Don’t wait to see what the attacker does next — by then, it’s usually too late.

Stealth Exit With a Heavyweight Backing

Tel Aviv-based Glow has pulled back the curtain on its operations, announcing a massive $180 million Series A round that values the young company at $1.2 billion. The funding, revealed on July 22, 2026, was led by a consortium including Sequoia, Cyberstarts, Greenoaks, and Redpoint Ventures.

Other investors in the round include Index Ventures, Swish Ventures, Lux Capital, and Holly Ventures. That’s a crowded cap table for a company that’s been operating in stealth mode, but it signals the kind of confidence investors are placing in the firm’s approach to endpoint security.

Founded by a Who’s Who of Security and Tech

Glow was founded in 2025 by a team with serious pedigree. CEO Roi Tiger previously served as VP of engineering at Meta. CTO Omer Singer was head of cybersecurity strategy at Snowflake. VP of R&D Ophir Arie held the same title at Claroty.

The leadership bench extends further. Arnon Joseph, formerly senior director of product at Meta, is Chief Product Officer. Emily Heath, who served as CISO at both United Airlines and DocuSign, is Chief Strategy Officer. Heath also sits on the board at Wiz and is a partner at Cyberstarts.

The Problem: Endpoints Are a Mess in the AI Age

The core pitch is straightforward, even if the technology behind it is complex. Traditional endpoint security tools weren’t built for environments where employees are feeding corporate data into AI tools at a dizzying pace, and where attackers are deploying what Glow describes as “Mythos-class capabilities” to exploit weaknesses at machine speed.

Glow’s answer is adaptive prevention. The company deploys specialized AI agents that map the environment, analyze risk in real time, and automatically enforce policies. It’s not about blocking everything—it’s about understanding context and making smart decisions about what should run on an endpoint.

“We leverage context and a reasoning engine to proactively allow or remove software,” the company explained. The goal is to shrink the endpoint attack surface while still letting employees adopt AI tools securely. That balance is the hard part, and it’s exactly where most legacy tools stumble.

Real Customers Already On Board

Despite the stealth mode, Glow hasn’t been hiding from everyone. The startup has already signed enterprise customers across financial services, healthcare, and retail. Those early adopters are a key validation point—they’re putting real workloads on a platform that, until today, was largely invisible to the broader market.

Heath, speaking from her experience in the CISO seat, framed the challenge in stark terms. “I sat in the CISO seat for a long time, and I can tell you the tools available to us were never built for what enterprises face today,” she said. “Every enterprise wants to move faster with AI. The question isn’t whether they’ll adopt it—it’s whether security can keep up.”

What the $180M Will Fund

The new capital is earmarked for two main priorities. First, accelerating go-to-market efforts in the US. Second, expanding Glow Labs, the company’s research arm.

For a company with this kind of valuation so early in its lifecycle, the pressure to deliver is real. But the team’s track record—Meta, Snowflake, Claroty, United Airlines, DocuSign—suggests they know what they’re getting into.

Related Funding News in Cybersecurity

Glow’s launch is part of a broader wave of investment in AI-focused security startups. Empirical Security Raises $25 Million in Series A Funding shows that even smaller rounds are attracting attention. Meanwhile, Neo Emerges From Stealth With $100M to Control and Secure Enterprise AI Software demonstrates that the market for AI security is heating up fast.

Other notable raises include Valarian Raises $50 Million for Sovereign Infrastructure Control Layer and Keyfactor’s $1 billion+ investment for AI and post-quantum security. The pattern is clear: investors are betting big on security startups that can handle the AI era’s unique challenges.

The Bottom Line

Glow’s launch is a signal, not just a funding announcement. It’s a bet that endpoint security needs a fundamental rethink—not incremental patches, but a new architecture built around AI agents and adaptive policies.

Whether the company can live up to its $1.2 billion valuation remains to be seen. But with a leadership team this experienced, and a funding round this large, Glow is certainly one to watch in the endpoint security space.

The 9.9 Problem at the Core

SAP’s July 2026 security update batch is out, and it carries a heavy hitter. The company has patched a critical vulnerability in SAP NetWeaver Application Server ABAP, tracked as CVE-2026-44747. With a CVSS score of 9.9, this is about as severe as it gets—just a hair below the maximum possible rating.

The flaw is an out-of-bounds write issue. An authenticated attacker can exploit logical errors in memory management to trigger memory corruption. The potential impact? Unauthorized exposure or modification of sensitive data. That’s the kind of scenario that keeps CISOs up at night.

For organizations running SAP NetWeaver ABAP—and that’s a massive chunk of the enterprise world—this isn’t a patch to postpone. The urgency is real, and the window for proactive action is now.

What Exactly Is CVE-2026-44747?

Let’s break down the technical details without drowning in jargon. The vulnerability resides in the memory management logic of the NetWeaver Application Server ABAP. An attacker with valid credentials—so not just anyone off the street—can send specially crafted requests that cause the system to write data outside the intended memory boundaries.

This out-of-bounds write can lead to memory corruption. From there, the attacker could potentially read or alter data that should be off-limits. Think of it as a digital lockpick that doesn’t just open the door but also lets you rearrange the furniture inside.

The CVSS 9.9 score reflects the severity: high attack complexity is low, the potential for data integrity and confidentiality impact is high, and the attack vector is network-based. The only saving grace is the authentication requirement, but in many enterprise environments, low-level credentials are easier to obtain than you’d hope.

Why the Authentication Requirement Isn’t a Free Pass

Some might breathe a sigh of relief seeing “authenticated attacker” in the advisory. Don’t. In a typical SAP landscape, there are often hundreds or thousands of users with some form of access—many of them with minimal privileges that could still be leveraged to exploit this flaw.

Insider threats are a genuine concern, but so are compromised credentials. A single phishing email that snags a low-level password could be the entry point. Once inside, the attacker can chain this vulnerability with other weaknesses to escalate privileges or move laterally across the network.

The bottom line: this flaw is not a theoretical risk. It’s a practical attack vector that demands immediate mitigation.

What Else Is in the July 2026 SAP Security Updates?

The July 2026 patch bundle from SAP isn’t a one-trick pony. Alongside the critical NetWeaver ABAP fix, the company addressed several other vulnerabilities across its product portfolio. While none of the others reached the 9.9 severity level, they still warrant attention as part of a comprehensive patch management strategy.

• Multiple cross-site scripting (XSS) issues in various SAP business applications that could allow attackers to inject malicious scripts.
• Information disclosure vulnerabilities that might expose sensitive configuration details to unauthorized users.
• Denial-of-service (DoS) flaws that could disrupt availability of critical business processes.

SAP’s release notes provide the full inventory, and it’s worth reviewing them thoroughly to identify which components in your environment are affected.

Immediate Steps for SAP Administrators

If you’re responsible for an SAP landscape, the playbook is clear. First and foremost, prioritize the deployment of the NetWeaver ABAP patch. The CVSS 9.9 score isn’t a suggestion—it’s a directive.

Here’s a practical checklist to guide your response:

1. Identify affected systems: Determine which of your NetWeaver ABAP instances are vulnerable. The patch applies to specific releases, so check your version against SAP’s advisory.
2. Plan the maintenance window: This patch may require downtime. Coordinate with business stakeholders to schedule it with minimal disruption.
3. Test in a sandbox first: If possible, apply the patch in a non-production environment to ensure compatibility with your custom code and configurations.
4. Monitor for indicators of compromise: Before patching, review logs for any suspicious activity that might indicate exploitation attempts.
5. Review user access: Since the flaw requires authentication, auditing your user base for unnecessary privileges is a smart move.

Don’t forget to check for related security notes and patches for other SAP components that might share dependencies with NetWeaver ABAP. A holistic approach is essential.

The Bigger Picture: SAP Security in 2026

SAP vulnerabilities are a recurring theme in enterprise security, and this latest critical flaw underscores the importance of staying current with patches. The company regularly releases security notes on the second Tuesday of each month, and the July 2026 batch is a stark reminder of the risks that lurk in complex enterprise software.

For organizations that rely heavily on SAP for core operations—ERP, supply chain, HR, and more—the stakes are exceptionally high. A data breach involving sensitive business information can have cascading consequences, from regulatory fines to reputational damage.

Beyond patching, consider implementing additional security measures. Network segmentation can limit the blast radius of a compromised system. Robust logging and monitoring can help detect suspicious activity early. And regular security audits can uncover misconfigurations that might otherwise go unnoticed.

If you’re looking to deepen your understanding of related threats, check out our guide on SAP security best practices to build a stronger defense posture. Also, review our analysis of recent enterprise software vulnerabilities to see how this flaw fits into the broader threat landscape.

Final Thoughts: Don’t Wait for the Breach

The CVSS 9.9 NetWeaver ABAP flaw is a wake-up call. It’s a critical reminder that even the most established enterprise software can harbor serious weaknesses. The patch is available, and the clock is ticking.

Expedite your patching process, communicate the urgency to your team, and ensure that your security operations are aligned with SAP’s release cycle. The cost of inaction could be far higher than the effort required to fix this now.

Stay vigilant, stay patched, and don’t let a 9.9 become your company’s next headline.